Editor’s note: This is the fourth of a four-part series, written by Strohl experts, that discusses best practices for conducting different types of business continuity planning tests and exercises. June featured advice on structured walkthrough exercises; July focused on tabletop exercises and August discussed functional exercises.

A full-scale exercise is the only type of exercise that enables an organization to come as close to recovering from a disaster as possible and therefore, the closest an organization could come to verifying its ability to continue operations in a real disaster. It is the most complex type of exercise and could last several hours to several days. Careful planning and execution are critical to avoid interference with actual production or operations.

Aside from all the other benefits that come with exercising recovery plans, such as building confidence in recovering and continuing operations following a disaster, a full-scale exercise is an incredible opportunity to create awareness. It also requires considerable preparation and follow-up. Senior management support and commitment is essential as several months to a couple of years may be required for coordination, planning, administration (of the actual exercise) and follow-up.

Structured walkthroughs, tabletop, functional, and isolated operational exercises (e.g. recovering a server in a test or lab environment) are helpful and recommended in preparing for participation in a full-scale exercise.

Participants
A full-scale exercise could be limited to the organization and its management, business and IT units, crisis management, communications, facilities/security, risk management/insurance, legal, hr, internal audit, and/or purchasing/receiving teams. A full-scale exercise is also an opportunity for an organization to interact with other organizations, private or public, including: key vendors, customers, the community, offices in other cities, states, or countries, primary responders in the public sector (e.g. local, state, or federal emergency management; police; fire; emergency medical units; hospitals; Red Cross; FEMA; military), educational institutions, utility service providers, public transportation or animal care organizations.

Full-scale exercises lend the circumstances for personnel, who might otherwise only meet or work with each other for the first time in an actual disaster, to work together in person, to develop and enhance relations and understand and improve communication styles.

The Scenario – Putting the whole story together
Careful planning of the scenario and scripts should include all scheduled participants. It is important to create very realistic scenarios as well as exercising basic aspects of the plan. Well thought-out sequencing of events to ensure all parts fit together at the right time with the right people is essential to the flow of the exercise as individuals realistically act or react to responses provided. However, if the exercise starts to go awry, it is the job of designated personnel, such as exercise masters, adjudicators or umpires to make necessary adjustments to keep the exercise going smoothly. Script writing for a full-scale exercise involving multiple situations occurring simultaneously, could be equated to writing a movie script that will be acted out in real life but without room for second takes.

Scheduling
Scheduling as far in advance as possible, avoiding “other” critical deadlines an organization may have, major holidays or other events in the area, enables better preparation and increases participation. Teams have time to develop clear and meaningful objectives, update plans, and train for and practice their roles and responsibilities before the big event. Scheduling logistics, such as obtaining locations and people’s time, can get quite complex depending on the number and types of sites and participants involved.

Working with the Media
If the exercise will involve external agencies, it is a good idea to provide the media advanced notification and for the media to provide advanced notification to the general public so they are not alarmed if they see a mass casualty incident down their street, for example. Work with the media to identify strategic locations where they can setup their equipment and observe the exercise without being inadvertently mixed into it, unless that is actually part of the scenario.

This type of exercise provides a very good setting for practicing with the media and strengthening the media communications plan. Understanding how to meet the media’s demands will increase their likelihood of receiving and delivering more factual messages to the public in an actual event. Exceptions for media involvement would be exercises involving highly confidential information.

Safety and Security
Whether it’s gaining security access to an internal or vendor recovery site, ensure there are procedures in place and that recovery site and recovery team members know these procedures so that only authorized personnel are allowed into restricted areas. Proper registration and visibly wearing officially distributed identification are not uncommon with full-scale exercises involving multiple agencies or organizations.

On the Big Day
Use of vendor sites and equipment may be charged by the hour, so arriving early to be able to begin the exercise on time would be highly desired. Participants may also need to arrive early to register and report to their assigned posts. Volunteer “victims” may need to be prepped or staged.

Identifying a way to officially start the exercise is a small but noteworthy element to prevent confusion in the event, particularly if the exercise includes external organizations. An exercise could begin with a phone call or e-mail/text message to various exercise officials. Depending on the way the exercise is structured, other announcements, such as basic ground rules and the first part of the scenario may also be revealed at this time.

Conversely, it’s also important to have a way to officially stop the exercise in the event that a real incident would occur and a true response become necessary.

During the Exercise
A good practice during any exercise is to try and maintain a certain calm. Keeping calm is essential for clear thinking and therefore good decision-making and proper actions taken.

Another good practice is to have assigned team scribes for logging progress, objectives met or unmet, issues or discoveries made during the exercise. The effects, with post-exercise (and post-disaster) activities including debriefs, analysis, reporting and recommendations for improvement, particularly with an exercise of large magnitude, are far-reaching as it is easy to quickly forget important details when there are a lot of things going on in an unfamiliar environment.

After the Exercise
Formal acknowledgment for everyone’s efforts as soon after the exercise as possible is paramount in showing appreciation as well as for garnering continued support for post and future exercise activities. In a post-exercise debrief, or also known as a hotwash or post-mortem, it is important to keep it somewhat structured but informal so participants can feel comfortable contributing their observations from the exercise. Such meetings typically occur immediately after or within a few days of the exercise. Emphasize that the intent of the exercise is for it to be beneficial and one in which all participants can learn from. Be sure to include input from management on their perspective of the exercise. Valuable information is often captured in post-exercise meetings for plan improvements as well as successful planning of future exercises.

In addition to the debrief, more in-depth meetings with teams for review and analysis is also important for addressing team-specific details or lessons learned. This information is useful for evaluation and education and for identifying improvements for response and recovery to an actual event as well as for future exercises.

An extensive investment of time and money goes into the planning and execution of a full-scale exercise. Reports of results may be distributed as appropriate to management, stakeholders, recovery teams, employees, vendors, customers, investors, and the media, as well as to the industry via articles, presentations at conferences or association meetings. The content and sensitivity of information reported will, of course, vary according to the audience and the sensitive nature of the exercise conducted. Identified improvements, for example, may be confidential and should only be shared with the respective organization.

In addition to fulfilling certain industry requirements for conducting exercises, full-scale exercises are the best form of hands-on training for disaster preparedness. And, as a result, they exhibit management’s commitment and dedication for managing disasters and continuing operations.

		About the Author
		Linda Pahkim, CBCP, is a consultant with Strohl Systems Group, Inc. and works nationally and internationally on all aspects of business continuity. She is the Speakers Bureau Coordinator for the Business Recovery Managers Association (BRMA) in Northern California providing educational presentations on BCP. Also trained in California’s Standard Emergency Management System (SEMS), Pahkim participates in disaster preparedness activities with local counties and cities.